Mixed controldata-flow representation for modelling and verification of embedded systems

MIXED CONTROL/DATA-FLOW REPRESENTATION FOR MODELLING AND VERIFICATION OFEMBEDDED SYSTEMSByMauricio VareaDepartment of Electronics and Computer Science,University of Southampton,United Kingdom.March2002UNIVERSITY OF SOUTHAMPTONABSTRACTFACULTY OF ENGINEERINGELECTRONICS AND COMPUTER SCIENCE DEPARTMENTMPhil/PhD Transfer ReportMixed Control/Data-Flow Representationfor Modelling and Verification of Embedded Systemsby Mauricio VareaEmbedded system design issues become critical as implementation technologies evolve. The interaction between the control and dataflow of an embedded system specification is an important consideration and,in order to cope with this aspect,a new internal design representation called Dual Flow Net(DFN)is introduced and further analysed in this thesis.One of the key features of this internal representation is its tight control and dataflow interaction,which is achieved by means of two new concepts.Firstly,the structure of the new DFN model is formulated employing a tripartite graph as basis, which turns out to be advantageous for modelling heterogeneous systems.Secondly,a complex domain marking scheme is used to describe the behaviour of the system,leading to better results in terms of modelling the dynamics of the embedded system specification. Structural definitions,behavioural rules and graphical representation of the new DFN model is presented in this work.Besides the potential application of the proposed DFN model in the realm of em-bedded system’s internal design representation,this thesis also addresses the verification of DFN models through formal methods.Behavioural properties of embedded systems, such as reachability,safety and liveness are expressed either in Computation Tree Logic (CTL)or in Linear Temporal Logic(LTL)formulae,and then verified using state-of-the-art tools.This thesis also addresses the implementation of an efficient library which undertakes the model checking problem in DFN models.Examples of varying complexity are presented in order to illustrate the feasibility and validity of the DFN model.These examples range from simple systems used to un-derstand the underlying semantics of the model,up to complex arrangements modelling real-life embedded systems.Furthermore,a number of relevant and challenging areas based on the DFN model(and its verification methodology),are outlined as future work.ContentsList of Symbols viiChapter1Introduction11.1Embedded Systems Design (1)1.1.1Modelling (3)1.1.2Validation (4)1.1.3Synthesis (6)1.2Motivation and Contributions (7)1.3Thesis Organisation (8)Chapter2Background and Related Work92.1Embedded System Modelling Techniques (9)2.1.1M CD models (10)2.1.2M DC models (11)2.1.3M¯B models (12)2.2Formal Verification of Embedded System models (12)2.2.1Temporal Logics (13)2.2.2Model Checking (13)2.2.3Automata-Theoretic Aproaches (14)2.3Concluding Remarks (14)Chapter3New Internal Design Representation:Dual Flow Nets163.1DFN structural model (17)3.1.1Structural model example (19)3.2A new concept in marking functions (20)3.3DFN behavioural model (23)3.3.1Behavioural model example (25)3.4Examples of Application (26)3.4.1Embedded Multiplier (26)Chapter4Formal Verification of the DFN model304.1Algorithms for Model Checking DFN models (30)4.2Implementation and Results (34)4.3VME-bus controller (35)Chapter5Conclusions385.1Future Work (38)Appendix A Complex Numbers40 Bibliography41List of Figures1.1Typical Embedded System Design Flow (2)1.2Relationship among Validation Methods (5)1.3Impact of Design on System Implementation Cost[100] (8)3.1The DFN philosophy (17)3.2DFN vertices interaction in both control and data domain (18)3.3A simple DFN model (20)3.4State space mapped into the complex plane (23)3.5Behavioural analysis of a DFN model (26)3.6Embedded Multiplier (27)3.7Multiplier algorithm (27)3.8DFN model of multiplier (28)4.1Our Model Checking Methodology (31)4.2Nondeterministic scheduler (31)4.3Place definition:data type (32)4.4Algorithm for a DFN Control Transition (32)4.5Algorithm for a DFN Hull (33)4.6Algorithm for a DFN Guard Function (34)4.7Verification time depending on the capacity K and the length L (35)4.8VME bus controller (36)List of Tables2.1Temporal Operators (13)List of Symbols=⇒implies⇐⇒if and only if ∈set membership ∪set union∩set intersection ∅empty set ∧logical and ∨logical or ∀for all∃there existsC /set of complex numbersi imaginary unit,i.e.√−1ℜ(ς)real part of ς∈C/ℑ(ς)imaginary part of ς∈C /|ς|modulus of ς∈C /∠ςphase of ς∈C/•x pre-set of x over the control domain ◦x pre-set of x over the data domain x •post-set of x over the control domain x ◦post-set of x over the data domainChapter1IntroductionEmbedded systems are task-specific mixed hardware/software systems which are part of a larger system.They often consist of both reactive and transformative functions which heavily interact with the environment.This functional combination makes them appli-cable to a variety offields such as mobile phones,cars,avionics,medical equipments, computer devices,consumer electronics,household appliances,etc.For instance,a mod-ern car may have up to70embedded systems[84],namely Engine Control Units(ECU), which aid in the cruise of the car(e.g.Anti-lock Braking System(ABS),fuel injection controller,electronic ignition system,etc.)Embedded system designers are facing up to the arduous reality in electronic indus-try:the customer is never satisfied.Therefore,there is an increasing design complexity while time-to-market windows are rapidly decreasing.Greater design complexities are in the aftermath of technology development,hence very likely to continue raising in the future.In addition,meeting the plummeting time-to-market imposed by the burgeon-ing technology is becoming a major challenge.Therefore,it is widely believed that the source for an overall improvement comes from the methodologies used along the design flow rather than more powerful processing engines devoted to implement the design.This thesis tackles the identification of features related to improving the designflow of embedded systems.The rest of this chapter introduces the overall embedded sys-tem designflow as well as the main objectives followed in this research.Section1.1 describes each process involved in the design of embedded systems.The main contribu-tions together with the underlying motivation of this work are highlighted in Section1.2. Finally,Section1.3concludes this chapter summarising the organisation of this thesis.1.1Embedded Systems DesignIncreasing development challenges,such as design complexity and time-to-market shrink-ing windows,are driving embedded system designers to look into the design process with the aim of optimising several design objectives simultaneously[33].The overallFigure1.1:Typical Embedded System Design Flowconstraint to these optimisation goals is the cost.However,achieving more cost-effective solutions,i.e.better performance/cost relation throughout the entire design process,does not necessarily mean that the cost is a target to optimise,it rather suggests that cost plays a ceiling role.Figure1.1shows a typical embedded system designflow.The two inputs to this sys-tematic approach are,on the one hand,the embedded system specification which contains all technology independent information and,on the other,the technology library consist-ing of a set of resources that defines the architecture to be used in the embedded system implementation.The output is thefinal implementation of the embedded system,which results from the heterogeneous integration of architectures carried out in the synthesis process.A cost-effective fulfilment of this designflow is carried out by hardware/software co-design methodologies[71,98],which reduce the time-to-market parameter by jointly designing both hardware and software components of an embedded system architecture.This state-of-the-art methodology is an elegant two-dimensional extention of the one-dimensional High Level Synthesis(HLS)methodology[40],which has gained vast ac-ceptance in both industry and academia[17,68,99].Three processes are identified in the embedded system designflow[32,71]:1.Modelling2.Validation3.SynthesisThese processes are fundamental steps in any methodology aimed to design an embed-ded system.In addition,correctness identification and estimation are intermediate steps which might be part of the methodology.However,in most cases these steps are sub-sumed by the three processes aforementioned.The following is a detailed description of each process.1.1.1ModellingWithin the designflow of embedded systems,there is an increasing number of cost-based decisions that depend on the information extracted by the modelling process.The out-come of this process,i.e.the internal design representation(IDR),is characterised by two orthogonal parameters[18]:scalability and expressiveness.Scalability is the capability to perform functional analysis of the model at different levels of complexity.One way to improve scalability indices of a model is by means of a convenient methodology that al-low representations at different levels of abstraction.Expressiveness depicts howflexible a model is,i.e.the amount of problems that can be captured by the IDR.This trade-off between scalability and expressiveness is evident in embedded systems,where the model has to be expressive enough to capture the features that influence the overall cost,but also sufficiently abstract to hide unnecessary details.The IDR not only unambiguously defines the embedded system specification,but also allows a better exploration among possible implementations of a design.Therefore, choosing an appropriate IDR facilitates the use of several tools for estimation,validation and synthesis.This requires a mechanism that precisely describes those aspects which are relevant to the specification and copes with all the interactions associated with them.With regard to the model,there are two main trends in hardware/software co-design of embedded systems[41]:When the IDR is given as textual language(L),or a graphical model of computation(MoC)based IDR.The main difference between these two trends is that thefirst one(L)tend to be most suitable for modelling systems where the organi-sation of the information is more important than the functionality,while the later(MoC) focus on such systems that priorises either functionality(states)or physical composition (architecture).However,should be noted that these trends are not mutually exclusiveand therefore it is possible to map a model from one approach to the other,i.e.either to graphically represent a language L or to put a MoC in a textual form.Despite not being well suited neither for state-oriented nor architectural purposes,tex-tual L s have gained more popularity than MoCs among synchronous embedded system designs mainly due to their ease of storage and manipulation which leads to less complex supporting tools,e.g.editors,translators and nguages such as Esterel[10] or Lustre[50]have ruled the L approach to both control-and data-dominated embedded systems respectively,taking into consideration many features of the design,e.g.con-currency,hierarchy,multi-rate clocking,etc.Furthermore,there is a well established community which considers that Hardware Description Languages(HDL)is already a standard IDR for the architecture of an embedded system.This includes languages L such as Verilog[85],VHDL[73]or SpecC[42],where the specification is given in terms of concurrent processes.On the contrary,MoCs such as StateCharts[30,51]are con-ceptually best suited for the representation of embedded system models,but suffers from being difficult to employ by the designer.Both forms of IDR,i.e.either textual or graphical based,have two well defined parts in order to undertake the statical and dynamical analysis of the embedded system,which are the structural and behavioural model.In textual L s,the interconnection of modules or entities1sets up the structure of the model while the behaviour is described in terms of a parallel or sequential execution of events.In graphical MoCs,the structural model refers to the topology of the formalism and the semantical-guided analysis of states or events brings out the behavioural model.1.1.2ValidationThrough the validation process,the designer achieves a reasonable level of confidence about how much of the original embedded system design will be in fact reflected in the final implementation.Early detection of design errors dramatically reduces the cost of design(see Figure1.3),since less reiterative work is carried out.The cost of detecting errors also increases as the designer goes further in the synthesis process.In general, there are three methods for validation:•Simulation(S)•Prototyping(P)•Formal Verification(FV)Figure1.2shows the goal of each method in terms of both behavioural coverage and structural accuracy.Based on the microeconomic theory of the consumer(MTC),where economists analyses the behaviour of rational consumers(i.e.those who intend to choose the best bundle of goods they can afford)by means of indifference curves and budget 1depending whether the syntax is defined by Verilog or VHDL language.lines[95],we infer the shape of efficiency and cost of the three methods for embedded system validation.Efficiency(referred as capacity in[100])is a trade-off between be-havioural coverage and structural accuracy,and cost is a measurement of the allocation of resources,e.g.memory,which is not necessarily reflected in the price of the tool.On the MTC theory,the indifference(hyperbolic)curves show the preference of the consumer for any combination of two products which gives him equal utility or satisfaction.The budget line illustrates alternative combination of both goods that can be purchased by the consumer given afixed income.Likewise,assuming that both coverage and accu-racy are goods(i.e.desired features),the efficiency of a validation method is given by an hyperbolic conduct while the cost is linear.Therefore,simulation(S)depicts an efficient-constant response where more accurate models can be analysed by means of a smaller the behavioural coverage.Since the actual implementation exists in prototyping(P),this method always has a maximum degree of structural accuracy,i.e.100%.Therefore,a higher coverage(hence efficiency)is only attained by increasing the cost.Finally,a maximum behavioural coverage is obtained by formal verification(FV)methods,where the accuracy(hence efficiency)can be raised by increasing the cost.Should be noted that maximum coverage at infinite accuracy is an utopian goal almost never achieved in realistic cases,due to strict cost margins.Figure1.2:Relationship among Validation MethodsWith reference to Figure1.1,either a stimulusfile or a set of properties are inputs to the validation method.The stimulus is used in when simulation methods while the set of properties are intrinsic of a formal verification method.In case of prototyping methods,an equivalent prototype of thefinal implementation has to be synthesised inorder to validate the design,which denotes a link between the validation and thefinal implementation(this is shown using a dashed line in Figure1.1).Much research has been carried out in the simulation of heterogeneous hardware/soft-ware embedded system[29,49,80,88].In contrast to simulation,which can only verify an embedded system behaviour for a particular stimulus,formal verification is capable of reasoning about properties usually expressed in temporal logics(ref.Section2.2.1)for all possible behaviours(i.e.maximum behavioural coverage).We will cover this in more depth,later in Section2.2.1.1.3SynthesisThefinal stage in the development of an embedded system is the synthesis process,which reduces the level of abstraction in the design until the desired implementation is obtained. This is equivalent to move horizontally in Figure1.2,towards maximum level of accu-racy.Within the designflow(Figure1.1),the abstract components of the IDR are combined with the technology library in order to produce an embedded systemfinal implementa-tion which meets the requirements.Merging the IDR with the technology library might sometimes take an additional architectural parameters estimation step,since the imple-mentation is not unique for a given IDR.Since the synthesis process is a knock-on effect of the IDR used,it heavily depends on the characteristics of the model.For instance, an IDR which explicitly denotes data dependencies facilitates the synthesis of hardware data path.It is important that architectural information is only added into this step of the design flow.If the specification(or the IDR)is too operational,i.e.influenced by the current technology,it will bias the design towards an architecture which might not be favourable to solve in the best way the problem formulated.The outcome of the synthesis process is afinal implementation of the embedded sys-tem,i.e.a mixed hardware/software system[1,38]serving to fulfil the specification re-quirements.This consists of a combination between standard and custom hardware.A standard hardware for an embedded system is typically made up of one or more commer-cial microprocessors(or microcontrollers),memory and interfacing units;whereas cus-tom hardware is implemented either as Application Specific Integrated Circuits(ASIC) or Field Programmable Gate Arrays(FPGA),depending on the desiredflexibility.Then, software processes are allocated to these hardware resources,providingflexibility into the embedded system implementation resulted[71,98].1.2Motivation and ContributionsAs discussed in Section1.1,the specification,internal design representation and imple-mentation of an embedded system tend to be highly heterogeneous parts in the design flow.Two different types of heterogeneity can be identified:•at the IDR level,the control and dataflow parts are unattached descriptions of the embedded system functionality which are tightly linked,and•at the implementation level,the execution of the embedded system’s task is per-formed by a mixed hardware/software architecture.This thesis concentrates on thefirst type of heterogeneity,since we strongly believe that an enhancement of the whole embedded system designflow depends more on the IDR used rather than the implementation architecture.A thorough examination in the realm of IDR for embedded systems indicates that despite the important role of modelling in the overall cost,it has not been sufficiently addressed yet.For instance,Figure1.3il-lustrates the design cost of System-on-a-Chip(SoC)technology[19]for two different assumptions:(a)no IDR used,and(b)the use of models which undergoes some success-ful paradigms such as reuse,platform-based design,hardware/software co-design,fault tolerance,intelligent testbench,etc.Thisfigure quantifies the impact of these paradigms on the design cost of low-power SoC(SOC-LP).Considering only the year2001,the cost of designing and implementing this type of embedded system equates2the sum of£10,540,200which represents an improvement of over22times w.r.t.an estimated £239,550,012without the influence of these innovational paradigms that had taken place over the last decade[100].This clearly shows the need for a better understanding of the underlying phenomena in embedded systems in order to obtain more cost-effective implementations.One of the key parameters that gives rise to this issue,is the existence of event driven mechanisms(controlflow)that curbs the operation of computationally intensive parts (dataflow).Control and dataflow cannot be analysed separately since there is a tight interaction between them.However,this interaction is not a trivial matter and it is seldom exploited by many approaches.To undertake the problem of efficiency in embedded system design,the aim of this thesis is to:1.Examine the role of modelling in the designflow and identify key features whichleads to better embedded system implementations.2.Propose a new IDR developed specifically to exploit the strong interconnectionbetween control and dataflow parts in embedded systems.2original values were published using US dollars as currency and then translated into GB pounds at the following rate:£1=$1.42942Year£ 7M19851990199520002010201520052020D e s i g n C o s t [l o g ]Figure 1.3:Impact of Design on System Implementation Cost [100]Furthermore,successful achievements of formal verification in the validation of industrial embedded system products (e.g.the verification of Futurebus+cache protocol [23]and the bug found in the Pentium Processor [25])leads up to take on this particular trend,in order to validate the IDR introduced.Therefore,an additional goal is to:3.Study verification techniques suited for the proposed model by using formal meth-ods.1.3Thesis OrganisationThe remainder of this thesis is organised as follows.Chapter 2briefly reviews some con-cepts used throughout this work,namely different forms of IDR for embedded systems and some general knowledge of formal verification.In Chapter 3a formal definition of the new DFN model is given,including structural and behavioural characteristics.This is our main attempt to achieve a well balanced mixed control/data-flow model in order to represent embedded systems.Some simple examples illustrate the applicability of the model into embedded system modelling and help to understand its semantics.A validation methodology,which is suitable for the design flow treated throughout this thesis,is introduced in Chapter 4.The chapter presents the full development and analysis of a four-module library for model checking DFN models.Also,some real-life examples provide an insight of the methodology and its mechanism.Finally,some conclusions with respect to the currently ongoing research are drawn in Chapter 5.This includes a brief outline of the future trend for the remaining of this work.Chapter2Background and Related WorkThis chapter presents an overview of the work carried out in thefield of embedded system modelling(Section2.1)and provides an introduction to the formal verification problem (Section2.2).The following two main sections survey the related work as well as bring forth an insight of the formalisms involved in both modelling and formal verification of embedded system.2.1Embedded System Modelling TechniquesModelling is the core of many disciplines in science and engineering.Either scientists or engineers have increased the insight knowledge of a physical phenomenon by represent-ing the interaction of different parameters as a model[103].For example,a well known set of equations developed by James C.Maxwell has provided to physicists an insight into the interactions between electric and magneticfields[79].The importance of modelling within the designflow of embedded systems has been discussed in Section1.1(refer to Figure1.1).Furthermore,Section1.2has argued the impact of the internal design representation used along the design on the complexity of the embedded system under development,hence its cost.It was shown that one of the main factors that influences this complexity is the control/data-flow linkage.In this section we describe some relevant formal models that have been used when describing embedded systems[66].In order to facilitate the literature reviewfindings,the models presented in this section are classified according to the following taxonomy:1.Models originally developed for control-dominated embedded system and later ex-panded to include dataflow(for ease of reference,these models are called M CD),2.Models developed in a data-dominated basis extended to support also controlflow(referred as to M DC),and3.Unbiased models developed specifically to deal with combined control/data-flowinteractions(M¯B).2.1.1M CD modelsThe development of a fundamental model for synchronous disrete-time systems was a landmark in the design of digital systems.The Finite-State Machine(FSM)model[45] has been widely used in control theory and is the foundation for the development of several internal design representations for control-dominated embedded systems.The FSM is a tuple S,I,O,f,h ,where S,I and O are the set of states,inputs and outputs respectively;f:S×I→S is the next-state function and h is the output function.FSMD Intuitively,the FSM definition given above can easily support data informa-tion just by extending each element of S,I and O from the boolean to the in-teger domain.This is,a Finite-State Machine with Datapath(FSMD)is a tuple S,V,I,O,f,h where S is the set of states,V is the set of datapath variables, I:I C×I D and O:O C×O D[39].Likewise,FSMD state transitions may include arithmetic and logic operations on the set of datapath variables.Although the num-ber of states is dramatically reduced,the state-explosion problem is still present. CFSM The Co-design Finite State Machines(CFSM)[21]is an extended asynchronous FSM that operates on a set of integer variables with arithmetic,relational and logical operators.This model is suitable for control-dominated applications of relatively low algorithmic complexity[20].For instance,the POLIS environ-ment[5,65,87]is based on the CFSM model of computation.Within this frame-work,specifications are given in a higher level language,usually ESTEREL[8–10], and the designer must manually do the partitioning and cosimulation.The later is performed by using the Ptolemy environment[13,14,86]which implements an efficient simulator for hierarchical FSM[15].Furthermore,CFSM are not only used within the POLIS framework.An attempt to develop a hardware/software co-design system which uses a statechart based tool for the specification of CFSM models instead,has been carried out in[6].This approach improves the cosimula-tion of CFSM models.The Petri net model[77]is another type of state-oriented model,which can efficiently exploit concurrency identification.A Petri net is a directed,weighted,bipartite graph PN= P,T,F,W ;where P is a set of vertices called places,T is another set of vertices (P∩T=∅)called transitions,F⊆(P×T)∪(T×P)is a set of arcs,and W:F→I N is a weight function,where a set of k arcs is represented by a single k-weighted arc[72]. However some definitions of the Petri net structure does not consider a weight function W,they rather formulate the net by means of bag theory,which allows(unlike classical sets)multiple occurrence of elements[76].The actual concept of states is associated to tokens,which inhere in places and circu-late through the net by the excecution offiring rules.High Level Petri Nets(HLPN)[54]include Predicate/Transitions Nets(PrT-Nets)[44] and Coloured Petri Nets(CPN)[55–57].Both approaches have been applied to embed-ded system modelling[46,60],but CPN has been leading the way.The following two models are prompted by CPN.CDFG The Quenya Control/Data-Flow Graph(CDFG)is a slightly modified version of the TaoDFG model which is based on CPNs[11].A Quenya CDFG is a directed graph where nodes represent data operations,control operations,comunication and miscellaneous,and edges form the control/data-flow.Edges may contain two type of tokens,which are d∈D for data-types,s∈S for value-less points of execution, or t∈T=D∪S for a combination of both.This is the kernel of the LYCOS system[67].PRES+In the Petri net based Representation for Embedded System(PRES+)model[26], tokens of the underlying PN are redefined in order to handle data information in addition to the controlflow manipulated during a classical execution of the net.PRES+has been applied to formal verification of Timed CTL(TCTL)proper-ties[3]using a transformation of PRES+into Timed Automata.Models con-structed at different levels of abstraction are possible by means of hierarchy[27].2.1.2M DC modelsThe modelling of transformational embedded systems has been primarily based on data flow graphs[28],since its suitability for scheduling.This model consists of a directed graph G=(V,E),where nodes V={ν1,ν2,···,νN},N=|V|represent computations and the arcs E⊆V×V describe the data dependency between operations,hence the processing order.FGM The Flow Graph Model(FGM)is a graph representation based on the model de-scribed above,where a polar acyclic G is used to represent sequential threads of execution[48].In this model(G),there are two particular nodesν0andνN which are source and sink operations respectively.Thus,a loop in the specification is captured by an infinite repeat count of G,i.e.the source operation is uncondition-ally called on the completion of the sink operation.The IDR consists of a set Φ={G1,G2,...,G n}of FGMs,a set of timing constraints(T)and a set of re-source constraints(R).This IDR is used in the VULCAN system[47],wherea HardwareC specification[62]is translated into FGM by a program called Her-cules[61].SPI The System Property Intervals(SPI)model consist of processes communicating through unidirectional channels,which are defined in terms of a tuple P,C,E , where P is a set of processes,C=Q∪R is a set of channels(composed of queues Q and registers R)and E=(P×C)∪(C×P)denotes a set of edges[104].The。